A script to help format profiles properly

[curiosityseeker]

This is just an update of #124. The script (which I called aaformat) supports the most important variables mentioned here. This version is more easily readable and slightly expanded. I'm presenting it here again as it might be helpful for supporters of this project and in the hope to receive some ideas how to improve it.

#!/bin/sh

sed -i.bak \
's|/usr/bin/bash|/{usr/,}bin/{,ba,da}sh|; 
s|/usr/bin|@{bin}|; 
s|/usr/lib|@{lib}|; 
s|/usr/lib32|@{lib}|;
s|owner /proc/\*/|owner @{PROC}/@{pid}/|; 
s|/proc|@{PROC}|; 
s|/sys/devices|@{sys}/devices|; 
s|/sys/bus|@{sys}/bus|; 
s|/sys/class|@{sys}/class|; 
s|/sys/fs|@{sys}/fs|; 
s|/run|@{run}|; 
s|/home/\*/|@{HOME}/|; 
s|@{HOME}/\*|@{HOME}|;
s|@{HOME}/.config|@{user_config_dirs}|; 
s|@{HOME}/\*/.config|@{user_config_dirs}|; 
s|@{HOME}/.cache|@{user_cache_dirs}|; 
s|@{HOME}/\*/.cache|@{user_cache_dirs}|;
s|@{HOME}/.local/share|@{user_share_dirs}|;
s|@{HOME}/\*/.local/share|@{user_share_dirs}|; 
s|/usr/share|@{system_share_dirs}|; 
s|@{run}/user/1000|@{run}/user/@{uid}|' /etc/apparmor.d/$1

[roddhjav]

Nice script. I have planned to integrate this substitution into aa-log to make it easier to everyone

[roddhjav]

The last version of aa-log now include this replacement by default. You may also test the new -r option...

[curiosityseeker]

Wow - very cool! Thanks a lot! Very helpful!

However, I noticed one error:

ALLOWED xdg-document-portal mount owner @{run}/user/@{uid}/doc/ info="failed srcname match" comm="fuse mainloop" error=-13 fstype=fuse.portal srcname=portal flags="rw, nosuid, nodev"

aa-log -r translated this to:

profile xdg-document-portal flags=(attach_disconnected ) {
  mount fstype=fuse.portal  portal-> @{run}/user/@{uid}/doc/,

}

which caused an error:

/etc/apparmor.d in profile /etc/apparmor.d/local/xdg-document-portal in Zeile 3: syntax error, unexpected TOK_ID, expecting TOK_END_OF_RULE or TOK_ARROW

The correct rule

mount fstype=fuse.portal -> @{run}/user/@{uid}/doc/,

has been added to the profile in the meantime, though.

EDIT: Another small issue:

profile brave {
  /opt/brave-bin/libqt5_shim.so rm,
  /opt/brave-bin/libqt6_shim.so rm,
  /bin/xdg-settings rix-> xdg-settings, # no new privs

}

Shouldn't this be @{bin}/xdg-settings rix ? And between rix and the arrow should be a space.

[roddhjav]

Yes, this is still an early wip version. For now there is no guarantee the rules generated are valid (still working on the test). This option was original an internal tool to help me creating the profiles, to me it is easy to correct this small issue by hand.

[curiosityseeker]

And between rix and the arrow should be a space.

Is this line 138 in template.j2 ?

[roddhjav]

Yes, I recently fix this (among other thing). See 5516eef

[curiosityseeker]

Hm, I'm still getting output from aa-log -r like this:

/usr/share/sddm/scripts/Xstop rix-> sddm//null-@{lib}/sddm/sddm-helper-start-x11user/@{uid}/null-/usr/share/sddm/scripts/Xstop,

Shouldn't line 138 in template.j2 rather be:

{{ " -> " }}{{ .MountPoint }}

i.e., with a space in front of -> ?

[roddhjav]

Should be fixed now. There are multiple other stuff that currently won't work is edge case. This is expected for now.